EBA consults on draft standards for operational risk management
Source
European Banking Authority
August 26, 2026
Source
European Banking Authority
August 26, 2026
The European Banking Authority (EBA) has initiated a public consultation on draft Regulatory Technical Standards (RTS) that specify the operational risk management framework required under Article 323 of the Capital Requirements Regulation (CRR3). The draft RTS outline harmonised, proportionate requirements for governance, management processes, and systems to identify, assess, monitor, and manage operational risk.
The consultation period runs until 31 December 2026. Stakeholders can submit comments via the EBA consultation page by clicking the “send your comments” button. A virtual public hearing will be held on 29 September 2026 from 10:00 to 12:00 CEST. Interested participants must register by 25 September 2026 using the provided link; dial-in details will be shared upon registration.
The draft RTS specify three main components of the operational risk management framework:
The standards clarify roles and responsibilities of management bodies, senior management, and the independent operational risk management function. They also set requirements for operational risk data, taxonomy, reporting, validation, and audit. ICT risk considerations are addressed through the Digital Operational Resilience Act (DORA).
A key feature of the draft RTS is proportionality, allowing institutions with a business indicator below EUR 750 million to benefit from less frequent reviews and reporting, reduced data granularity, loss thresholds, and simplified taxonomy.
The RTS are developed under Article 323(2) of Regulation (EU) No 575/2013 (CRR), as amended by Regulation (EU) 2024/1623 (CRR3). They support the EU Banking Package, replacing previous approaches with a standardised approach based on the business indicator. The standards align with Basel principles, EBA guidelines on governance, and the EU framework on digital operational resilience established by DORA.
